CVE-2026-5709highCWE-78

CVE-2026-5709: fallo de gravedad alta en AWS Research and Engineering Studio (RES)

AWS Research and Engineering Studio (RES) FileBrowser Command Injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Research and Engineering Studio

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 1.1%
Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
AWS · Research and Engineering Studio (RES)
CVEs relacionadas — AWS Research and Engineering Studio (RES)

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-5707HIGHCommand Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)EPSS 1.0%CVE-2026-5708HIGHImproper Control of User-Modifiable Attributes in RES CreateSession APIEPSS 0.9%CVE-2025-12815MEDIUMCVE-2025-12815EPSS 0.3%